@didit-protocol/sdk-node 2.14.0 → 2.15.0

package/dist/index.d.cts

@@ -736,6 +736,10 @@ interface AddressValidationResult {
     formatted_address: string | null;
     latitude: number | null;
     longitude: number | null;
+    /** The kind of delivery point the address is, for United States and Canadian addresses: `street`, `po_box` (a PO box or lock box), `high_rise` (a high-rise or business complex), `rural_route`, `general_delivery`, `firm` (a firm or company address) or `building`. `null` for addresses in other countries, when the address has no type on record, and when `status` is `unavailable`. */
+    address_type: "street" | "po_box" | "high_rise" | "rural_route" | "general_delivery" | "firm" | "building" | (string & {}) | null;
+    /** `true` when the address is a residence, `false` when it is a business. `null` when this is unknown, when it is not available for the address's country, and when `status` is `unavailable`. Available for addresses in the United States, Great Britain, the Netherlands and Ireland. */
+    is_residential: boolean | null;
 }
 /** The normalised address. `null` when `status` is `unavailable`. */
 interface AddressValidationResultAddress {
@@ -815,7 +819,7 @@ interface Application {
     /** Internal description for the application (not shown to end users). */
     description?: string | null;
     created_at?: Date;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** The application's products. Always all three, in this order: `identity`, `transactions`, `authentication`. A new application has `identity` enabled with every module on, and `transactions` and `authentication` disabled. Read-only: a `products` key in a create or update body is ignored. */
     products?: ApplicationProduct[];
@@ -1174,13 +1178,13 @@ interface ApplicationCredentialsSummary {
     client_id?: string;
     /** Use this as `x-api-key` on every verification API call. New keys start with `sk_live_` (live application) or `sk_test_` (sandbox application), followed by 43 URL-safe characters (letters, digits, `-` and `_`). Keys created before this format have no prefix and keep working unchanged. */
     api_key?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** The application's environment. A `live` application bills every verification session and check created with its key. A `sandbox` application mocks every check and is never billed, so it is where you test (each sandbox application can create 500 test sessions every 24 hours). Read this field to pick the application: never infer the environment from the name. */
     mode?: "live" | "sandbox" | (string & {});
 }
-/** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
-type ApplicationDataLocation = "eu" | "au" | "mx" | "ae" | (string & {});
+/** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+type ApplicationDataLocation = "eu" | "au" | "mx" | "ae" | "us" | (string & {});
 /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
 type ApplicationInitiateLoginURI = string;
 /** One product of an application and its state. Read-only: the application endpoints return it and ignore it in a request body. */
@@ -1218,6 +1222,8 @@ interface BankAccountCheckResponse {
     result: "match" | "close_match" | "no_match" | "cannot_verify" | (string & {});
     /** Only on a `close_match`, and only when the bank returned it: the name on the account, as the bank holds it. `null` otherwise. */
     holder_name: string | null;
+    /** The 0 to 100 similarity between the holder name you sent and the name on the account: the score `result` was decided on, so you can apply your own threshold. `result` stays authoritative and is decided with the default thresholds, a `match` from 85 and a `close_match` from 70 up to 84; they are the workflow settings `bank_name_match_threshold` and `bank_partial_match_floor` in a verification session. A name with nothing in common scores `0`. `null` when no name was compared: `cannot_verify`, a `no_match` for an account that does not exist, or a bank that answered with its own verdict and no holder name or score. */
+    name_match_score: number | null;
     /** The account, masked to its last 4 characters. */
     account: string;
     /** Your own reference, as you sent it. */
@@ -11069,7 +11075,7 @@ interface AccountApplicationsCreateParams {
     privacy_url?: string;
     /** Internal description for the application (not shown to end users). */
     description?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
     initiate_login_uri?: ApplicationInitiateLoginURI;
@@ -11094,7 +11100,7 @@ interface AccountApplicationsUpdateParams {
     privacy_url?: string;
     /** Internal description for the application. */
     description?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
     initiate_login_uri?: ApplicationInitiateLoginURI;
@@ -11264,7 +11270,7 @@ declare class AddressValidation extends APIResource {
      *
      * **Billing.** A live call costs $0.10 per validated address. An `unavailable` result is not charged. Nothing is stored apart from the usage record: no session is created and the result is returned only in this response.
      *
-     * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, without consuming credits.
+     * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, with `address_type` and `is_residential` always `null` (the keys are present), without consuming credits.
      *
      * **Authentication.** Send your application's API key in `x-api-key`. Missing or invalid credentials return `403` - this API never returns `401`.
      *
@@ -11814,13 +11820,13 @@ declare class Bank extends APIResource {
      *
      * **What you send.** The account's `country` (ISO 3166-1 alpha-3), the `account` the way that country writes it, and the `holder` name: `full_name` for a person or `business_name` for a company. A business name checks a business account.
      *
-     * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `account` comes back masked to its last 4 characters.
+     * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `name_match_score` is the 0 to 100 similarity `result` was decided on, so you can apply your own threshold; `result` stays authoritative, decided with the default thresholds (a `match` from 85, a `close_match` from 70). It is `null` when no name was compared: a `cannot_verify`, or a `no_match` for an account that does not exist. `account` comes back masked to its last 4 characters.
      *
      * **Billing.** Each check the bank answers is billed once at the Account check price of the account's country, whatever the result: a `no_match`, an account that does not exist and a `cannot_verify` are billed too. A request answered with an error is never billed.
      *
      * **Every request is a new check.** There is no idempotency key and no endpoint to read a check back, so a retried request runs, and is billed, again. Store the response.
      *
-     * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one, `0003` and `0006` a `no_match`, `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match`.
+     * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one (`name_match_score` 78), `0003` a `no_match` (`name_match_score` 0), `0006` a `no_match` for an account that does not exist (`name_match_score` null), `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match` (`name_match_score` 100).
      *
      * **API keys.** A scoped API key needs write access to sessions.
      *
@@ -18948,6 +18954,8 @@ interface SessionsCreateParams {
     metadata?: unknown;
     /** Tags added to the session when it is created, by name. Up to 10, each up to 50 characters. Names are case-insensitive and stored in upper case. A name that does not exist yet in the application is created as a new tag. The tags show on the session in the console, where you can filter by them. */
     tags?: string[];
+    /** Seconds this session's link stays valid, overriding the workflow's `session_expiration_time` for this session only. Whole number between 3600 (1 hour) and 2419200 (4 weeks), the same bounds as the workflow setting. Omit it to use the workflow's setting. A value outside the range, or one that is not a whole number, returns `400` on `session_expiration_time`. A session created by this call takes this lifetime from creation. When the call returns an existing unfinished session instead of creating one, sending this field resets that session's expiry to now plus this value, and omitting it leaves that session's expiry as it is. The response returns the resulting `expires_at`. */
+    session_expiration_time?: number;
     /** Language code (ISO 639-1) for the verification process interface. Controls the language displayed to the end user during verification. If not provided, the browser's language will be automatically detected and used. Check all the supported languages [here](/integration/supported-languages). */
     language?: "en" | "ar" | "bg" | "bn" | "bs" | "ca" | "cnr" | "cs" | "da" | "de" | "el" | "es" | "et" | "fa" | "fi" | "fr" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "it" | "ja" | "ka" | "kk" | "ko" | "ky" | "lt" | "lv" | "mk" | "mn" | "ms" | "nl" | "no" | "pl" | "pt-BR" | "pt" | "ro" | "ru" | "sk" | "sl" | "so" | "sq" | "sr" | "sv" | "th" | "tr" | "uk" | "uz" | "vi" | "zh-CN" | "zh-TW" | "zh" | (string & {});
     /** User contact information that can be used for notifications, prefilling verification forms, and phone verification. This includes email address, preferred language for communications, and phone number. */
@@ -19037,7 +19045,9 @@ interface SessionsCreateResponse {
     metadata: unknown;
     /** The tags on the session, by name. */
     tags?: string[];
-    /** Current status of the session. Newly created sessions return `Not Started`. If a non-finished session already existed for the same `vendor_data` on the workflow's latest published version, the returned status reflects that existing session. */
+    /** When the session's link stops being valid: the start of its current validity window (its creation, or the last reset by `session_expiration_time`) plus the lifetime in force. */
+    expires_at?: Date;
+    /** Current status of the session. Newly created sessions return `Not Started`. For a User Verification workflow, if a non-finished session already existed for the same `vendor_data` on the workflow's latest published version, the returned status reflects that existing session. */
     status: "Not Started" | "In Progress" | "Approved" | "Declined" | "In Review" | "Expired" | "Abandoned" | "Kyc Expired" | "Resubmitted" | "Awaiting User" | (string & {});
     /** Final redirect URL the user is sent to after completing the flow. Didit appends `?verificationSessionId={session_id}&status={status}` to this URL. Falls back to the workflow's configured callback URL when not provided in the request; `null` when neither is set. When the application has allowed domains and this URL is a web URL outside them (for example a workflow default set before the list changed), the hosted flow does not redirect the user to it. */
     callback: string | null;
@@ -20433,9 +20443,9 @@ declare class Sessions extends APIResource {
      *
      * Call this from your backend (never the browser - the API key is a secret) whenever a user or business needs to be verified: at signup, before a sensitive action, or when re-verification is required. Prerequisites: a published workflow (created in the Console [Workflows](https://docs.didit.me/console/workflows) page) and an application API key with available credits. Sandbox applications bypass the credit check.
      *
-     * **Idempotency:** when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused.
+     * **Idempotency:** for a User Verification workflow, when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused. A Business Verification workflow creates a new session on every call.
      *
-     * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
+     * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after `session_expiration_time` seconds when the request sets it, otherwise after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
      *
      * `POST /v3/session/`
      */
@@ -23896,7 +23906,7 @@ declare class TokenVerificationError extends DiditError {
     constructor(reason: TokenVerificationReason, message: string);
 }
 
-declare const VERSION = "2.14.0";
+declare const VERSION = "2.15.0";
 
 /**
  * The canonical JSON of a parsed webhook body: the text `X-Signature-V2` signs

package/dist/index.d.ts

@@ -736,6 +736,10 @@ interface AddressValidationResult {
     formatted_address: string | null;
     latitude: number | null;
     longitude: number | null;
+    /** The kind of delivery point the address is, for United States and Canadian addresses: `street`, `po_box` (a PO box or lock box), `high_rise` (a high-rise or business complex), `rural_route`, `general_delivery`, `firm` (a firm or company address) or `building`. `null` for addresses in other countries, when the address has no type on record, and when `status` is `unavailable`. */
+    address_type: "street" | "po_box" | "high_rise" | "rural_route" | "general_delivery" | "firm" | "building" | (string & {}) | null;
+    /** `true` when the address is a residence, `false` when it is a business. `null` when this is unknown, when it is not available for the address's country, and when `status` is `unavailable`. Available for addresses in the United States, Great Britain, the Netherlands and Ireland. */
+    is_residential: boolean | null;
 }
 /** The normalised address. `null` when `status` is `unavailable`. */
 interface AddressValidationResultAddress {
@@ -815,7 +819,7 @@ interface Application {
     /** Internal description for the application (not shown to end users). */
     description?: string | null;
     created_at?: Date;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** The application's products. Always all three, in this order: `identity`, `transactions`, `authentication`. A new application has `identity` enabled with every module on, and `transactions` and `authentication` disabled. Read-only: a `products` key in a create or update body is ignored. */
     products?: ApplicationProduct[];
@@ -1174,13 +1178,13 @@ interface ApplicationCredentialsSummary {
     client_id?: string;
     /** Use this as `x-api-key` on every verification API call. New keys start with `sk_live_` (live application) or `sk_test_` (sandbox application), followed by 43 URL-safe characters (letters, digits, `-` and `_`). Keys created before this format have no prefix and keep working unchanged. */
     api_key?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** The application's environment. A `live` application bills every verification session and check created with its key. A `sandbox` application mocks every check and is never billed, so it is where you test (each sandbox application can create 500 test sessions every 24 hours). Read this field to pick the application: never infer the environment from the name. */
     mode?: "live" | "sandbox" | (string & {});
 }
-/** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
-type ApplicationDataLocation = "eu" | "au" | "mx" | "ae" | (string & {});
+/** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+type ApplicationDataLocation = "eu" | "au" | "mx" | "ae" | "us" | (string & {});
 /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
 type ApplicationInitiateLoginURI = string;
 /** One product of an application and its state. Read-only: the application endpoints return it and ignore it in a request body. */
@@ -1218,6 +1222,8 @@ interface BankAccountCheckResponse {
     result: "match" | "close_match" | "no_match" | "cannot_verify" | (string & {});
     /** Only on a `close_match`, and only when the bank returned it: the name on the account, as the bank holds it. `null` otherwise. */
     holder_name: string | null;
+    /** The 0 to 100 similarity between the holder name you sent and the name on the account: the score `result` was decided on, so you can apply your own threshold. `result` stays authoritative and is decided with the default thresholds, a `match` from 85 and a `close_match` from 70 up to 84; they are the workflow settings `bank_name_match_threshold` and `bank_partial_match_floor` in a verification session. A name with nothing in common scores `0`. `null` when no name was compared: `cannot_verify`, a `no_match` for an account that does not exist, or a bank that answered with its own verdict and no holder name or score. */
+    name_match_score: number | null;
     /** The account, masked to its last 4 characters. */
     account: string;
     /** Your own reference, as you sent it. */
@@ -11069,7 +11075,7 @@ interface AccountApplicationsCreateParams {
     privacy_url?: string;
     /** Internal description for the application (not shown to end users). */
     description?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
     initiate_login_uri?: ApplicationInitiateLoginURI;
@@ -11094,7 +11100,7 @@ interface AccountApplicationsUpdateParams {
     privacy_url?: string;
     /** Internal description for the application. */
     description?: string;
-    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico) and `ae` (United Arab Emirates) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
+    /** Where the application's verification data is stored and processed, chosen when the application is created. `eu` is the European Union (Ireland), the default. `au` (Australia, Sydney), `mx` (Mexico), `ae` (United Arab Emirates) and `us` (United States, N. Virginia) are coming soon: a request that names them answers 400 `This data location is not available yet.` An organization's Sandbox application is always in the European Union. */
     data_location?: ApplicationDataLocation;
     /** Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link. */
     initiate_login_uri?: ApplicationInitiateLoginURI;
@@ -11264,7 +11270,7 @@ declare class AddressValidation extends APIResource {
      *
      * **Billing.** A live call costs $0.10 per validated address. An `unavailable` result is not charged. Nothing is stored apart from the usage record: no session is created and the result is returned only in this response.
      *
-     * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, without consuming credits.
+     * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, with `address_type` and `is_residential` always `null` (the keys are present), without consuming credits.
      *
      * **Authentication.** Send your application's API key in `x-api-key`. Missing or invalid credentials return `403` - this API never returns `401`.
      *
@@ -11814,13 +11820,13 @@ declare class Bank extends APIResource {
      *
      * **What you send.** The account's `country` (ISO 3166-1 alpha-3), the `account` the way that country writes it, and the `holder` name: `full_name` for a person or `business_name` for a company. A business name checks a business account.
      *
-     * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `account` comes back masked to its last 4 characters.
+     * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `name_match_score` is the 0 to 100 similarity `result` was decided on, so you can apply your own threshold; `result` stays authoritative, decided with the default thresholds (a `match` from 85, a `close_match` from 70). It is `null` when no name was compared: a `cannot_verify`, or a `no_match` for an account that does not exist. `account` comes back masked to its last 4 characters.
      *
      * **Billing.** Each check the bank answers is billed once at the Account check price of the account's country, whatever the result: a `no_match`, an account that does not exist and a `cannot_verify` are billed too. A request answered with an error is never billed.
      *
      * **Every request is a new check.** There is no idempotency key and no endpoint to read a check back, so a retried request runs, and is billed, again. Store the response.
      *
-     * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one, `0003` and `0006` a `no_match`, `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match`.
+     * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one (`name_match_score` 78), `0003` a `no_match` (`name_match_score` 0), `0006` a `no_match` for an account that does not exist (`name_match_score` null), `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match` (`name_match_score` 100).
      *
      * **API keys.** A scoped API key needs write access to sessions.
      *
@@ -18948,6 +18954,8 @@ interface SessionsCreateParams {
     metadata?: unknown;
     /** Tags added to the session when it is created, by name. Up to 10, each up to 50 characters. Names are case-insensitive and stored in upper case. A name that does not exist yet in the application is created as a new tag. The tags show on the session in the console, where you can filter by them. */
     tags?: string[];
+    /** Seconds this session's link stays valid, overriding the workflow's `session_expiration_time` for this session only. Whole number between 3600 (1 hour) and 2419200 (4 weeks), the same bounds as the workflow setting. Omit it to use the workflow's setting. A value outside the range, or one that is not a whole number, returns `400` on `session_expiration_time`. A session created by this call takes this lifetime from creation. When the call returns an existing unfinished session instead of creating one, sending this field resets that session's expiry to now plus this value, and omitting it leaves that session's expiry as it is. The response returns the resulting `expires_at`. */
+    session_expiration_time?: number;
     /** Language code (ISO 639-1) for the verification process interface. Controls the language displayed to the end user during verification. If not provided, the browser's language will be automatically detected and used. Check all the supported languages [here](/integration/supported-languages). */
     language?: "en" | "ar" | "bg" | "bn" | "bs" | "ca" | "cnr" | "cs" | "da" | "de" | "el" | "es" | "et" | "fa" | "fi" | "fr" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "it" | "ja" | "ka" | "kk" | "ko" | "ky" | "lt" | "lv" | "mk" | "mn" | "ms" | "nl" | "no" | "pl" | "pt-BR" | "pt" | "ro" | "ru" | "sk" | "sl" | "so" | "sq" | "sr" | "sv" | "th" | "tr" | "uk" | "uz" | "vi" | "zh-CN" | "zh-TW" | "zh" | (string & {});
     /** User contact information that can be used for notifications, prefilling verification forms, and phone verification. This includes email address, preferred language for communications, and phone number. */
@@ -19037,7 +19045,9 @@ interface SessionsCreateResponse {
     metadata: unknown;
     /** The tags on the session, by name. */
     tags?: string[];
-    /** Current status of the session. Newly created sessions return `Not Started`. If a non-finished session already existed for the same `vendor_data` on the workflow's latest published version, the returned status reflects that existing session. */
+    /** When the session's link stops being valid: the start of its current validity window (its creation, or the last reset by `session_expiration_time`) plus the lifetime in force. */
+    expires_at?: Date;
+    /** Current status of the session. Newly created sessions return `Not Started`. For a User Verification workflow, if a non-finished session already existed for the same `vendor_data` on the workflow's latest published version, the returned status reflects that existing session. */
     status: "Not Started" | "In Progress" | "Approved" | "Declined" | "In Review" | "Expired" | "Abandoned" | "Kyc Expired" | "Resubmitted" | "Awaiting User" | (string & {});
     /** Final redirect URL the user is sent to after completing the flow. Didit appends `?verificationSessionId={session_id}&status={status}` to this URL. Falls back to the workflow's configured callback URL when not provided in the request; `null` when neither is set. When the application has allowed domains and this URL is a web URL outside them (for example a workflow default set before the list changed), the hosted flow does not redirect the user to it. */
     callback: string | null;
@@ -20433,9 +20443,9 @@ declare class Sessions extends APIResource {
      *
      * Call this from your backend (never the browser - the API key is a secret) whenever a user or business needs to be verified: at signup, before a sensitive action, or when re-verification is required. Prerequisites: a published workflow (created in the Console [Workflows](https://docs.didit.me/console/workflows) page) and an application API key with available credits. Sandbox applications bypass the credit check.
      *
-     * **Idempotency:** when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused.
+     * **Idempotency:** for a User Verification workflow, when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused. A Business Verification workflow creates a new session on every call.
      *
-     * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
+     * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after `session_expiration_time` seconds when the request sets it, otherwise after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
      *
      * `POST /v3/session/`
      */
@@ -23896,7 +23906,7 @@ declare class TokenVerificationError extends DiditError {
     constructor(reason: TokenVerificationReason, message: string);
 }
 
-declare const VERSION = "2.14.0";
+declare const VERSION = "2.15.0";
 
 /**
  * The canonical JSON of a parsed webhook body: the text `X-Signature-V2` signs

package/dist/index.js

@@ -324,7 +324,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.14.0";
+var VERSION = "2.15.0";
 
 // src/core/runtime.ts
 function processLike() {
@@ -1632,6 +1632,7 @@ var DATE_PLANS = {
     p: { results: { i: { p: { biometric_template_expires_at: 1 } } } }
   },
   SessionsCreateKybPartyDraftResponse: { p: { created_at: 1, updated_at: 1 } },
+  SessionsCreateResponse: { p: { expires_at: 1 } },
   SessionsDeleteResponse: { p: { biometric_template_expires_at: 1 } },
   SessionsImportsListActiveJobsResponse: { p: { results: { i: "ImportJobSummary" } } },
   SessionsImportsListErrorsResponse: { p: { results: { i: "SessionImportError" } } },
@@ -2141,7 +2142,7 @@ var AddressValidation = class extends APIResource {
    *
    * **Billing.** A live call costs $0.10 per validated address. An `unavailable` result is not charged. Nothing is stored apart from the usage record: no session is created and the result is returned only in this response.
    *
-   * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, without consuming credits.
+   * **Sandbox.** Sandbox keys validate the request and always return a deterministic `verified` result that echoes the address sent, with `address_type` and `is_residential` always `null` (the keys are present), without consuming credits.
    *
    * **Authentication.** Send your application's API key in `x-api-key`. Missing or invalid credentials return `403` - this API never returns `401`.
    *
@@ -2335,13 +2336,13 @@ var Bank = class extends APIResource {
    *
    * **What you send.** The account's `country` (ISO 3166-1 alpha-3), the `account` the way that country writes it, and the `holder` name: `full_name` for a person or `business_name` for a company. A business name checks a business account.
    *
-   * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `account` comes back masked to its last 4 characters.
+   * **What you get back.** `result` is `match`, `close_match`, `no_match` or `cannot_verify`. On a `close_match`, `holder_name` is the name the bank holds the account under, when the bank returned it. `name_match_score` is the 0 to 100 similarity `result` was decided on, so you can apply your own threshold; `result` stays authoritative, decided with the default thresholds (a `match` from 85, a `close_match` from 70). It is `null` when no name was compared: a `cannot_verify`, or a `no_match` for an account that does not exist. `account` comes back masked to its last 4 characters.
    *
    * **Billing.** Each check the bank answers is billed once at the Account check price of the account's country, whatever the result: a `no_match`, an account that does not exist and a `cannot_verify` are billed too. A request answered with an error is never billed.
    *
    * **Every request is a new check.** There is no idempotency key and no endpoint to read a check back, so a retried request runs, and is billed, again. Store the response.
    *
-   * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one, `0003` and `0006` a `no_match`, `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match`.
+   * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one (`name_match_score` 78), `0003` a `no_match` (`name_match_score` 0), `0006` a `no_match` for an account that does not exist (`name_match_score` null), `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match` (`name_match_score` 100).
    *
    * **API keys.** A scoped API key needs write access to sessions.
    *
@@ -6769,7 +6770,12 @@ var SESSIONS_CANCEL_FEATURE_OVERRIDE = {
   path: "/v3/session/{sessionId}/features/overrides/{overrideId}/cancel/",
   dates: "FeatureStatusOverride"
 };
-var SESSIONS_CREATE = { method: "POST", path: "/v3/session/", body: "json" };
+var SESSIONS_CREATE = {
+  method: "POST",
+  path: "/v3/session/",
+  body: "json",
+  dates: { p: { expires_at: 1 } }
+};
 var SESSIONS_CREATE_KYB_PARTY_DRAFT = {
   method: "POST",
   path: "/v3/session/{sessionId}/kyb/parties/drafts/",
@@ -7414,9 +7420,9 @@ var Sessions = class extends APIResource {
    *
    * Call this from your backend (never the browser - the API key is a secret) whenever a user or business needs to be verified: at signup, before a sensitive action, or when re-verification is required. Prerequisites: a published workflow (created in the Console [Workflows](https://docs.didit.me/console/workflows) page) and an application API key with available credits. Sandbox applications bypass the credit check.
    *
-   * **Idempotency:** when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused.
+   * **Idempotency:** for a User Verification workflow, when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`, `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current latest published version** (and that session already has a hosted verification URL), the existing session is returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the newly provided values. An unfinished session created on an older version of the workflow (one that has since been republished) is **not** reused; a new session pinned to the latest published version is created instead. Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused. A Business Verification workflow creates a new session on every call.
    *
-   * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
+   * **Side effects:** the hosted verification URL is generated and stored; if `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is sent. The session expires after `session_expiration_time` seconds when the request sets it, otherwise after the workflow's configured session expiration time. For KYB workflows, `contact_details.phone` and `expected_details` are ignored.
    *
    * `POST /v3/session/`
    */